CVE-2026-74725 (GCVE-0-2026-74725)
Vulnerability from cvelistv5 – Published: 2026-08-22 15:33 – Updated: 2026-08-22 15:33
VLAI
EPSS
VEX
Title
enic: fix tx_hang_reset use-after-free on device removal
Summary
In the Linux kernel, the following vulnerability has been resolved:
enic: fix tx_hang_reset use-after-free on device removal
enic_remove() cancels the reset and change_mtu_work items but does not
cancel tx_hang_reset. A TX timeout that fires while the device is being
removed can schedule enic_tx_hang_reset() so that it runs after
free_netdev(), resulting in a use-after-free.
cancel_work_sync() alone is not sufficient here: the still-live watchdog
and notify paths can re-schedule these work items in the window between
the cancel and unregister_netdev(). Use disable_work_sync(), which
cancels the work and blocks any subsequent schedule_work() from
requeuing it, and apply it to the reset and change_mtu_work items as
well so the same requeue race is closed for all teardown work.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | CPE status | |
|---|---|---|---|---|
| Linux | Linux |
Affected:
937317c7c1097aa878a5000e3aab616eb5c590c0 , < 8619865f34fb3b130b567855382a5c4aadd522b9
(git)
Affected: 937317c7c1097aa878a5000e3aab616eb5c590c0 , < e506e704b74748ffd0e1c92a7453ca2a959f832b (git) Affected: 937317c7c1097aa878a5000e3aab616eb5c590c0 , < 4f3464fc6c1f26afc504fd525c574f2bc14c9d42 (git) Affected: 937317c7c1097aa878a5000e3aab616eb5c590c0 , < ec680ea4ba1bca92a767fb7e7869758bfdd886e3 (git) |
guessed | |
| Linux | Linux |
Affected:
4.4
Unaffected: 0 , < 4.4 (semver) Unaffected: 6.12.104 , ≤ 6.12.* (semver) Unaffected: 6.18.45 , ≤ 6.18.* (semver) Unaffected: 7.1.9 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
guessed |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/cisco/enic/enic_main.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "8619865f34fb3b130b567855382a5c4aadd522b9",
"status": "affected",
"version": "937317c7c1097aa878a5000e3aab616eb5c590c0",
"versionType": "git"
},
{
"lessThan": "e506e704b74748ffd0e1c92a7453ca2a959f832b",
"status": "affected",
"version": "937317c7c1097aa878a5000e3aab616eb5c590c0",
"versionType": "git"
},
{
"lessThan": "4f3464fc6c1f26afc504fd525c574f2bc14c9d42",
"status": "affected",
"version": "937317c7c1097aa878a5000e3aab616eb5c590c0",
"versionType": "git"
},
{
"lessThan": "ec680ea4ba1bca92a767fb7e7869758bfdd886e3",
"status": "affected",
"version": "937317c7c1097aa878a5000e3aab616eb5c590c0",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/cisco/enic/enic_main.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.4"
},
{
"lessThan": "4.4",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.104",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.45",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.104",
"versionStartIncluding": "4.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.45",
"versionStartIncluding": "4.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.9",
"versionStartIncluding": "4.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "4.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nenic: fix tx_hang_reset use-after-free on device removal\n\nenic_remove() cancels the reset and change_mtu_work items but does not\ncancel tx_hang_reset. A TX timeout that fires while the device is being\nremoved can schedule enic_tx_hang_reset() so that it runs after\nfree_netdev(), resulting in a use-after-free.\n\ncancel_work_sync() alone is not sufficient here: the still-live watchdog\nand notify paths can re-schedule these work items in the window between\nthe cancel and unregister_netdev(). Use disable_work_sync(), which\ncancels the work and blocks any subsequent schedule_work() from\nrequeuing it, and apply it to the reset and change_mtu_work items as\nwell so the same requeue race is closed for all teardown work."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-22T15:33:16.460Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/8619865f34fb3b130b567855382a5c4aadd522b9"
},
{
"url": "https://git.kernel.org/stable/c/e506e704b74748ffd0e1c92a7453ca2a959f832b"
},
{
"url": "https://git.kernel.org/stable/c/4f3464fc6c1f26afc504fd525c574f2bc14c9d42"
},
{
"url": "https://git.kernel.org/stable/c/ec680ea4ba1bca92a767fb7e7869758bfdd886e3"
}
],
"title": "enic: fix tx_hang_reset use-after-free on device removal",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74725",
"datePublished": "2026-08-22T15:33:16.460Z",
"dateReserved": "2026-08-15T05:44:03.929Z",
"dateUpdated": "2026-08-22T15:33:16.460Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"nvd": "{\"cve\":{\"id\":\"CVE-2026-74725\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-08-22T16:16:47.567\",\"lastModified\":\"2026-08-22T16:16:47.567\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nenic: fix tx_hang_reset use-after-free on device removal\\n\\nenic_remove() cancels the reset and change_mtu_work items but does not\\ncancel tx_hang_reset. A TX timeout that fires while the device is being\\nremoved can schedule enic_tx_hang_reset() so that it runs after\\nfree_netdev(), resulting in a use-after-free.\\n\\ncancel_work_sync() alone is not sufficient here: the still-live watchdog\\nand notify paths can re-schedule these work items in the window between\\nthe cancel and unregister_netdev(). Use disable_work_sync(), which\\ncancels the work and blocks any subsequent schedule_work() from\\nrequeuing it, and apply it to the reset and change_mtu_work items as\\nwell so the same requeue race is closed for all teardown work.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/net/ethernet/cisco/enic/enic_main.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"937317c7c1097aa878a5000e3aab616eb5c590c0\",\"lessThan\":\"8619865f34fb3b130b567855382a5c4aadd522b9\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"937317c7c1097aa878a5000e3aab616eb5c590c0\",\"lessThan\":\"e506e704b74748ffd0e1c92a7453ca2a959f832b\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"937317c7c1097aa878a5000e3aab616eb5c590c0\",\"lessThan\":\"4f3464fc6c1f26afc504fd525c574f2bc14c9d42\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"937317c7c1097aa878a5000e3aab616eb5c590c0\",\"lessThan\":\"ec680ea4ba1bca92a767fb7e7869758bfdd886e3\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/net/ethernet/cisco/enic/enic_main.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4.4\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"4.4\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.104\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.45\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.9\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/4f3464fc6c1f26afc504fd525c574f2bc14c9d42\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/8619865f34fb3b130b567855382a5c4aadd522b9\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/e506e704b74748ffd0e1c92a7453ca2a959f832b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/ec680ea4ba1bca92a767fb7e7869758bfdd886e3\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
}
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Loading…
Loading…